For investors
Regulated European organisations will customise their own AI models on their own hardware. Under the EU AI Act, many of them become the legally accountable provider of what they build. SPINALIS is the platform that builds those models — and records how each one was made, as it happens.
01The problem we solve
Solved
Free tools, one GPU, private data. Nobody needs us for this.
Solved
Local runtimes serve it fast. We export to their formats.
Open
No tool records it. So the answer is typed up by hand, months later, from memory and email.
Fine-tune a model on your own data and, under Regulation (EU) 2024/1689, you may become the provider of a high-risk AI system. Then these are the questions you have to answer — for every model, for ten years.
| What you will be asked | With a trainer | With SPINALIS |
|---|---|---|
| What data was it trained on?Data governance | reconstructed later | recorded at the build, with hashes |
| Can you rebuild this exact model?Record-keeping | rarely | seed, dataset hash, environment |
| How well does it work, and on what test?Accuracy & robustness | a number in a slide | held-out evaluation, stored with the build |
| Who checked it, and who approved it?Human oversight | an email thread | sign-off enforced before deployment |
| Where is the technical file?Annex IV | written by hand afterwards | generated from the build record |
| Is it still behaving as approved?Post-market monitoring | nobody checks | scheduled revalidation, alerts on drift |
| Whose rights could it affect?Art. 27 | a workshop, if at all | assessment drawn from the same record |
None of this is a feature of a trainer. It is a property of the process that produced the model — which is what we sell.
02Why now
December 2027
Binding obligations for Annex III high-risk systems apply from December 2027. Procurement in regulated organisations takes 12–24 months — those decisions are being made now.
Finance, insurance, defence and public administration may not send proprietary or personal data to third-country cloud AI — by data-protection law, sectoral rules, national security or internal classification.
It keeps data in the Union and may satisfy part of financial services. It does not enter an air-gapped network, does not meet a no-egress policy, and does not produce the evidence.
03Product and proof
Ingest, synthesise, train, verify, sign off, serve and monitor on the customer's hardware. Every stage writes to one append-only, hash-chained audit journal; Annex IV and Article 27 documents are generated from it.
Language, documents, search over data, vision, speech, tables — without task-specific code. Three unrelated tasks are measured end to end, with their fine print, on the customer page.
Validated in a relevant environment: customer-class hardware, air-gapped, separated roles, human sign-off before deployment and an immutable audit journal.
Outputs are executed against a governed data snapshot and compared by result, not by textual similarity — the same primitive measures quality, filters synthetic training data and constrains what a deployed endpoint may return.
04Business model
A governed AI system is one solution promoted into production under governance: one entry in the register of AI systems an organisation must maintain. GPU count measures computation, which is commoditised; the number of governed systems measures regulatory exposure. Versions, retraining and redundant replicas are not counted.
Price points
€0 · €24,000 · from €90,000 · from €160,000 Community · Pro · Enterprise · Sovereign, per year
First engagements are fixed-price and fixed-scope: one governed model and its complete conformity dossier, delivered inside the customer's perimeter.
Customer economics
€12,000–40,000 manual evidence per system, per year
Producing and maintaining the evidence for one high-risk system takes an estimated 14–28 specialist person-days a year at €900–1,400 per day. With two governed systems Pro costs no more than doing it by hand at the lowest estimate; from three it is cheaper.
05Market
A deliberate lower bound. Not counted: defence and public administration in Europe, the regulated supply chains that inherit the same evidence duties through vendor due diligence, and North America, where model-risk supervision and the NIST AI RMF demand the same properties.
06Competition and moat
| Who else the budget can go to | Trains models | Serves models | Evidence from execution | Runs air-gapped | Accountable vendor |
|---|---|---|---|---|---|
| Building it internallythe primary competitor | yes | yes | years of work nobody funds | yes | no |
| Open-source trainers, no-code studiose.g. Unsloth Studio | yes | yes | no | yes | AGPL, no vendor |
| AI governance and GRC platformsclosest in purpose | no | no | typed in by people | varies | yes |
| Cloud fine-tuning services | yes | yes | no | no | yes |
| Local inference runtimes | no | yes | no | yes | mixed |
| SPINALIS | yes | yes | yes | yes | yes |
The one that matters is the first row. A capable bank assembles the training stack in a fortnight. The governance layer — sign-off, tamper-evident audit, lineage, reproducible builds, generated technical files, revalidation — is several engineer-years, shows no visible capability, and is the part that never gets built.
GRC platforms sit above the engineering process and collect assertions typed by people; we sit inside it and derive the artefacts from execution. Compatible, not competing. Local runtimes are complementary too — we export to the formats they serve.
A proprietary licence under EU law on a permissive-only stack (Apache-2.0, MIT, BSD). Faster copyleft kernels are given up deliberately, so the product clears procurement.
Audit chain, lineage and revalidation history accumulate inside the customer's perimeter for years. Every record exports in open formats — but the continuous, verified history grows with every build.
Licences verified offline against machine fingerprints, no telemetry, releases carry their own integrity check. Built for air-gapped sites from day one, not retrofitted.
Swappable profile packs map one engineering record onto a given regime: the EU AI Act first, ISO/IEC 42001 and the NIST AI RMF through the same mechanism.
07Plan
Months from project start.
08Team
Building the technology — and selling it into regulated procurement. Clearly separated mandates; strategic decisions need both.
Co-founder · Chief Technology Officer
Senior machine-learning and MLOps engineer, and sole author of the delivered system: the Go control plane and API, the Python training and serving runtime, the web interface, the licensing and anti-tamper subsystem, and the complete governance layer. Previously built an ML platform serving around 400 data scientists and 3,000 production models in financial services at scale.
Owns product, architecture and engineering.
Co-founder · Chief Operating Officer
Fifteen years building and turning around technology and delivery organisations of up to 600 people, with portfolios above $30M a year. Recovered government and banking programmes; on the founding leadership team of an industrial IoT platform, delivered an on-premise manufacturing execution system at a major oil refinery. Ran enterprise presales and doubled presale-to-contract conversion; recruited around 500 people in two years and set up two engineering offices. Led a cyber-security function; AMBA-accredited MBA.
Owns commercial strategy, delivery, partnerships, operations and P&L.
Self-funded: the entire system was built without institutional capital.
Investor briefings, the technical due-diligence pack and a live walkthrough of the platform on request.